{"id":228,"date":"2016-01-05T23:38:45","date_gmt":"2016-01-05T23:38:45","guid":{"rendered":"http:\/\/verticalagetechnologies.com\/?p=228"},"modified":"2016-03-24T13:32:57","modified_gmt":"2016-03-24T13:32:57","slug":"system-center-config-manger-and-endpoint-protection-in-citrix-pvs","status":"publish","type":"post","link":"https:\/\/verticalagetechnologies.com\/index.php\/2016\/01\/05\/system-center-config-manger-and-endpoint-protection-in-citrix-pvs","title":{"rendered":"System Center Endpoint Protection & Config Manger in Citrix Xenapp\/PVS"},"content":{"rendered":"

\"antivirus-heading\"<\/a><\/p>\n

One o\"citrix-logo-250x250\"<\/a>f my clients is undergoing a complete Datacenter transformation. \u00a0With this comes a lengthy list of multiple decisions on what to bring over from the old to the new. \u00a0This post will focus on transitioning their current virtual machine anti-virus protection to a new solution. \u00a0The new solution is System Center Configuration Manager\/Endpoint Protection\u00a0in a Citrix XenApp\/PVS environment. \u00a0This consists of Citrix Xenapp 6.5, PVS 7.1, and System Center 2012 R2. \u00a0Although, I don’t really see any reason these same steps wouldn’t work in \u00a0later versions of Xenapp and PVS.<\/p>\n

Currently they are using Trend Micro Deep Security 9.5 and OfficeScan 11.x to protect their Endpoints as well as their virtual machines. \u00a0I have to say, I do really like Deep Security to protect the virtual machines. \u00a0Very little maintenance is required and it just seems to do its job well. \u00a0Unfortunately, somebody has to pay the bills to keep it\u00a0licensed. \u00a0The client decided to utilize their current Microsoft ‘Enterprise Agreement’ licensing and protect themselves with System Center Endpoint Protection, with Config Manager managing the agents.<\/p>\n

While I do realize there are other blog posts out there that contain similar information on this topic, I was not able to use just one site to complete this project. \u00a0At the bottom of the post I document where I got most of the resources used to complete this project.\"SystemCenterEndpointProtection\"<\/a><\/p><\/blockquote>\n

First, we need to install SCCM into the image. \u00a0SCCM is used to manage and control the agents centrally. \u00a0It is used to control all the special exclusions, real-time scan settings, etc… \u00a0Without it, you would have to manage each agent manually.<\/p>\n

SCCM Steps:<\/strong><\/p>\n

    \n
  1. Create a new PVS Version<\/li>\n
  2. Install the ConfigMgr client
    \na. Launch the SCCM setup client from the SCCM server – \\\\SCCMserver\\Client\\CCMSetup.exe
    \nb. Add ‘domain\\username’ domain\u00a0account as local admin on the xenapp 6.5 server.<\/li>\n<\/ol>\n

    SCEP Steps:<\/strong><\/p>\n

      \n
    1. Run bat file:\n
        \n
      1. MKDIR e:\\SCEP\n
          \n
        1. this is the ‘cache drive’ used to store RAM overflow, event viewer, pagefile, and SCEP anti-virus definitions.<\/li>\n<\/ol>\n<\/li>\n
        2. cmd.exe \/c Mklink \/d \/j \u201cC:\\ProgramData\\Microsoft\\Microsoft Antimalware\u201d E:\\SCEP<\/li>\n
        3. Install SCEP executable
          \n\\\\servername\\Client\\SCEPinstall.exe<\/li>\n<\/ol>\n<\/li>\n
        4. In SCCM After SCEP\/SCCM is deployed:\n
            \n
          1. Create Device Collection\n
              \n
            1. Add your servers to the collection that you are installing SCEP on.<\/li>\n<\/ol>\n<\/li>\n
            2. Create Endpoint Protection Policy\n
                \n
              1. Apply to Device Collection (Device\/Antimalware policies tab)\n
                  \n
                1. \"SCEP-antimalware-policy\"<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n
                2. Create Deployment Endpoint Protection Policy\n
                    \n
                  1. Apply to Device Collection (Device\/Client settings tab)\n
                      \n
                    1. \"SCEP-protection-policy\"<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                      Final Steps:<\/strong><\/p>\n

                        \n
                      1. Seal Image using the following bat file:\n
                          \n
                        1. Net stop “SMS Agent Host”<\/li>\n
                        2. del %WINDIR%\\smscfg.ini<\/li>\n
                        3. Powershell -command “Remove-Item -Path HKLM:\\Software\\Microsoft\\SystemCertificates\\SMS\\Certificates\\* -Force”<\/li>\n
                        4. wmic \/namespace:\\\\root\\ccm\\invagt path inventoryActionStatus where InventoryActionID=”{00000000-0000-0000-0000-000000000001}” DELETE \/NOINTERACTIVE<\/li>\n
                        5. Del “c:\\programdata\\citrix\\pvsagent\\LocallyPersistedData\\CCMData\\CCMCFG.bak”<\/li>\n<\/ol>\n<\/li>\n
                        6. Use Xenapp Role Manager to do the final seal and shutdown the image.<\/li>\n<\/ol>\n

                          Confirm Steps:<\/strong><\/p>\n

                            \n
                          1. Confirm SCCM Policy Deployment to the SCEP agent (on the SCEP agent, drop down arrow, about)\n
                              \n
                            1. \"SCCM-confirm3\"<\/a><\/li>\n<\/ol>\n<\/li>\n
                            2. Confirm the devices are manageable in SCCM\n
                                \n
                              1. \"SCCM-confirm1\"<\/a><\/li>\n
                              2. \"SCCM-confirm2\"<\/a><\/li>\n<\/ol>\n<\/li>\n
                              3. Test Protection\n
                                  \n
                                1. I was able to test protection using a ‘dummy’ anti-virus test file<\/li>\n
                                2. http:\/\/www.eicar.org\/\n
                                    \n
                                  1. create the .txt file with the string in it.<\/li>\n
                                  2. Safe the file<\/li>\n<\/ol>\n<\/li>\n
                                  3. SCEP should recognize it as a threat and clean the file appropriately<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                    That’s it, your Citrix PVS machines should now be protected by System Center Configuration Manager and System Center Endpoint Protection. \u00a0Now I realize there are 100 ways to skin a cat. \u00a0Please let me know if have\/find any efficiency’s in the steps and i’ll be happy to change the contents of the site.<\/p>\n

                                    A big THANK YOU to everyone involved in creating and helping answer questions on the following sites:<\/p>\n

                                    SCCM:<\/strong><\/p>\n